1. Information We Collect
Information You Provide
- Account registration: email address and password. On some parts of the platform, we also ask how you use BrightSprout (e.g., teacher, homeschooler, parent, or other).
- Payment information: when you purchase a subscription, your payment is processed by Stripe. We never store full credit card numbers on our servers. We may store limited payment details such as the last four digits of your card for your reference.
- Content you create: worksheets, crosswords, word searches, bingo cards, flashcards, and other materials you create on the platform. You control whether your content is public or private.
- Communications: information you provide when you contact our support team.
Information Collected Automatically
When you visit the Site, we automatically collect:
- Log data: IP address, browser type and version, device information, pages visited, time and date of your visit, time spent on pages, and referring URL.
- Cookies and similar technologies: we use cookies to keep you logged in, remember your preferences, and support analytics and advertising. See the Cookies section below for details.
- Analytics and session data: we use third-party analytics services that collect usage data, which may include session recordings and heatmaps. See Third-Party Services below.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the platform
- Process transactions and manage subscriptions
- Send you service-related communications (such as password resets, purchase confirmations, and account updates)
- Send you promotional emails about our products and features (you can opt out at any time — see Communications and Marketing below)
- Analyze usage patterns to improve the platform
- Run A/B tests to improve the user experience
- Monitor for errors and maintain platform stability
- Measure the effectiveness of our advertising
- Generate and improve content on the platform
We do not sell your personal information to third parties.
We do not display advertisements on our platform and never will.
3. Third-Party Services
We share data with the following categories of third-party service providers, solely to operate and improve the platform:
| Category | Providers | What They Receive |
|---|---|---|
| Hosting & infrastructure | DigitalOcean, Cloudflare | All site data necessary to serve and protect the platform |
| Payment processing | Stripe | Payment and billing information |
| Analytics | Google Analytics, Microsoft Clarity, Statsig | Usage data, device info, IP address; Clarity may record browsing sessions; Statsig processes data for A/B testing |
| Advertising & remarketing | Google Ads, Microsoft Ads | Conversion events (e.g., signups, purchases) and remarketing data to show relevant ads to visitors on other sites |
| Brevo | Email address and message content for transactional and promotional emails | |
| Error monitoring | Sentry | Error logs, which may include device info and limited session data |
| Customer support | Groove | Information you provide in support requests |
| Clipart search | The Noun Project | Search terms entered when browsing clipart (no personal data is shared) |
| Content generation | Anthropic (Claude) | Content from public documents may be sent to the Anthropic API to generate or improve platform content. Private documents are never sent. |
These providers process data on our behalf and are contractually required to protect it. We do not sell or share your personal information with third parties for their own marketing purposes.
4. Cookies
We use cookies and similar technologies for the following purposes:
- Essential cookies: keeping you logged in and enabling core site functionality.
- Analytics cookies: understanding how visitors use the site (Google Analytics, Microsoft Clarity, Statsig).
- Advertising cookies: measuring the effectiveness of our ad campaigns and showing relevant ads to visitors on other sites (Google Ads, Microsoft Ads).
- Infrastructure cookies: Cloudflare may set cookies for security and performance purposes.
Cookie consent: If you are located in a region that requires consent for non-essential cookies (such as the EU/EEA or UK), we display a cookie consent banner and do not load analytics or advertising scripts until you accept. In other regions, these scripts load automatically.
You can also manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing ones. Note that disabling cookies may affect site functionality, such as staying logged in.
You can opt out of Google Analytics tracking at Google Analytics Opt-out Browser Add-on Download Page.
5. Your Content
When you create content on BrightSprout, you generally choose whether it is public or private. One exception: worksheets published under the free tier are always public. Privacy controls are available for all other document types and for worksheets published under paid plans.
Public content is accessible to other users and may appear in search results, browse pages, and other parts of the platform. Public document content may be processed by third-party AI services to generate or improve platform content.
Private content is accessible only to you and anyone you share it with directly. Private content is not processed by third-party AI services.
You may delete content you have created at any time.
6. Communications and Marketing
We may send you the following types of email:
- Service-related emails: password resets, purchase confirmations, account updates, and other messages necessary to operate your account. You cannot opt out of these.
- Promotional emails: product updates, feature announcements, and suggestions related to BrightSprout. You can opt out of promotional emails at any time by clicking the "unsubscribe" link at the bottom of any promotional email.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you with our services. Content you delete is removed from public view; depending on the part of the platform, deleted content may be retained in our database in a deactivated state.
If you request account deactivation or data deletion, see Your Rights below.
8. Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information. Payment processing is handled by Stripe, a PCI-compliant payment processor. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
9. Your Rights
All Users
You may:
- Access the personal information we hold about you
- Update your account information through your account settings
- Opt out of promotional emails at any time
- Delete content you have created
- Request account deactivation: we will disable your account and stop contacting you
- Request full data deletion: we will remove your personal information from our systems. To request this, contact us at [email protected] and specify that you are requesting full deletion of your data.
California Residents
Under the California Consumer Privacy Act (CCPA), California residents have additional rights:
- Right to know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it is shared.
- Right to delete: you may request deletion of your personal information, subject to certain legal exceptions.
- Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.
We do not sell personal information as defined by the CCPA.
To exercise these rights, contact us at [email protected]. We will verify your identity before processing your request and respond within 45 days.
European Economic Area, UK, and Other GDPR-Covered Regions
If you are located in the EEA, UK, or another region covered by the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate data
- Erasure: request deletion of your personal data (the "right to be forgotten")
- Restriction: request that we restrict processing of your data
- Portability: request a copy of your data in a structured, machine-readable format
- Objection: object to our processing of your data, including for direct marketing
- Withdraw consent: where processing is based on consent, you may withdraw it at any time
Our legal bases for processing your data include: performance of a contract (providing you with the service), legitimate interests (improving our platform, preventing fraud), consent (marketing emails, non-essential cookies in regions requiring consent), and legal obligations.
To exercise your rights, contact us at [email protected]. We will respond within 30 days.
10. Do Not Track
Some browsers offer a "Do Not Track" (DNT) signal. We rely on third-party services (such as Google Analytics and Microsoft Clarity) that may or may not honor DNT signals independently. We recommend using browser-level opt-out tools or the cookie controls described above for more reliable tracking management.
11. Children's Privacy
BrightSprout is designed for use by educators, parents, and adults. For detailed information about how we handle data from children and students, including our COPPA and FERPA compliance practices, please see our Student Privacy Policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a prominent notice on our site or by email. Your continued use of the platform after changes are posted constitutes your acceptance of the revised policy.
13. Contact Us
If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at: [email protected]